c911f8fb2caa508c114df862d0e376b8f2e36b472f3d8b811747b0bd719c5eb4 | Triage

Analysis

max time kernel
27s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08/02/2023, 15:52

Sharing

Report Analysis Logs

General

Target

ContinuedHere/ContinuedHere.exe
Size

700.0MB
MD5

b244c1e5cc28a14540a42aaad12ae9fd
SHA1

0ebf5997643e5f4005eb0e3fc42de0d730089e8b
SHA256

3d633a0c8d525a5bd29ec2c834660d3d47139a3529ba6410973a9d51774a0991
SHA512

e0decdcdf0db62de1622346f114aad4db0a3f6d5b8d6b5cf01ecd6c9d05a30d65a704f755d7cb866aba13c273ab73ef4010ec20d14ca437635b8b7b657b71a75
SSDEEP

12288:QQiyVD/1ZGm/VeM9Iy5HdlObEl934hyGiinqXUYu5:NDbGTM9IQHjObCU+inN5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
904	948	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 904	948	ContinuedHere.exe	28
PID 948 wrote to memory of 904	948	ContinuedHere.exe	28
PID 948 wrote to memory of 904	948	ContinuedHere.exe	28

C:\Users\Admin\AppData\Local\Temp\ContinuedHere\ContinuedHere.exe
"C:\Users\Admin\AppData\Local\Temp\ContinuedHere\ContinuedHere.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 948 -s 544
  2⤵
  - Program crash
  PID:904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-54-0x0000000000170000-0x0000000000208000-memory.dmp

Filesize
608KB

Download